So it's incumbent on IT organizations not only to prioritize the software that must be patched, but also to identify the systems whose patches must be tested. Meantime, they can reduce the exposure of their unpatched systems by implementing tiered security: firewalls, intrusion-prevention systems, updated antivirus software and the like. Even the most basic desktop defenses should have been enough to stop Zotob and its ilk.
For the more insidious threats, however, none of this "defense in depth" will get much easier. Gartner predicts that system prioritization and patch testing/deployment will remain largely manual tasks "well beyond 2007." And while security is being integrated into network infrastructure and packaged into all-in-one desktop suites, the attackers are getting more sophisticated as well.
Perhaps no other profession spends so much time fixing and defending flawed products purchased at considerable expense from reputable vendors. Regardless, if you don't have a patching strategy, develop one as part of a more comprehensive effort to understand your remaining security risks.
Rob Preston is editor in chief of Network Computing. Write to him at [email protected].
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
